CVE-2024-50051
Published: 11 January 2025
Description
In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: Add cancel_work_sync before module remove If we remove the module which will call mpc52xx_spi_remove it will free 'ms' through spi_unregister_controller. while the work ms->work will be used. The sequence of operations that may lead to a UAF bug. Fix it by ensuring that the work is canceled before proceeding with the cleanup in mpc52xx_spi_remove.
Security Summary
CVE-2024-50051 is a use-after-free (UAF) vulnerability in the Linux kernel's mpc52xx SPI driver. The issue arises during module removal via mpc52xx_spi_remove, where the 'ms' structure is freed through spi_unregister_controller, but the associated work item ms->work may still be executed afterward, leading to a UAF condition. This affects systems running vulnerable versions of the Linux kernel that include the mpc52xx SPI driver, with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-416.
A local attacker with low privileges can exploit this vulnerability by triggering the module removal sequence, potentially causing the UAF to occur. Successful exploitation could allow the attacker to achieve high-impact confidentiality, integrity, and availability effects, such as arbitrary code execution, data corruption, or system crashes, depending on the timing and context of the work item execution.
The provided kernel patch references detail the mitigation, which involves adding cancel_work_sync() in mpc52xx_spi_remove to ensure the work item is canceled before cleanup proceeds, preventing the UAF. Security practitioners should apply the stable kernel commits (e.g., 373d55a47dc6, 90b72189de2c) to affected systems.
Details
- CWE(s)